Your Data Is Hijacked: How Would You Know?

Aug. 13, 2013 - 03:45AM
|

Kevin Coleman ()

As the United States aggressively addresses cyber attack weapons and actors, our adversaries morph their techniques and expand their targets. Several current and former military and intelligence officials, as well as subject matter experts in the private sector, have issued statements about the continuous attacks our computer systems and devices are under. One of the more recent statements that increased the level of anxiety of cybersecurity professionals was made by Sean Kanuck of the Office of the Director of National Intelligence. His threat warning was not about the disruption of systems operations via distributed denial of service attacks or the theft of information, but rather the modification of critical data we rely on.

Those defending our systems have long expressed concern about the disruption of the Global Positioning System. Now they have a new attack scenario to worry about: the alteration of GPS data, giving users a false sense of location. Think that is farfetched or too difficult to pull off? Just recently a team of researchers from the University of Texas at Austin with limited resources took control of an $80 million superyacht’s navigation system using a homemade device. Their homebrew cyber weapon sent the luxury vessel on a course of their choosing by altering the GPS data. The yacht’s captain and crew were totally unaware that their GPS system was misrepresenting their locations and course. This is not the first time GPS data has been spoofed. In 2011 there were reports that Iran compromised GPS data, which resulted in their capture of one of our surveillance drones.

These are two troubling examples and the issue goes far beyond GPS data. Detecting subtle changes to data is much harder than you might think. It can also be far more damaging than traditional attacks. Just imagine for a moment not knowing the current state of your organization. Unsure of your finances, resources, inventory, location of assets and the status of current operations — how do you make decisions? Think of the turmoil in the global financial markets if such an attack targeted the Fortune 1000. The resulting turmoil would be a major national security issue.

Kevin Coleman is a senior follow at the Technolytics Institute and former chief strategist at Netscape.